[Closed] Another redirect victim. I've tried everything and it won't go away

Status
Not open for further replies.
S

sccomputerguys

Posts: 20   +0
Hi, my name is Gene. Like many other posts, I recently was infected with a re-direct virus that re-directs virtually all searches. Any help is appreciated!! I will post my logs from the 7 step process above as soon as possible. Thanks!!
 
FYI... I have already tried using

ComboFix
MBAM
TDSSKiller
aswMBR
CCLeaner
TFC
DDS
Defogger

RKUnhooker wont run (Exception erreor) and I can't install AVG (Windows Installer error).
 
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7068

Windows 6.1.7601 Service Pack 1 (Safe Mode)
Internet Explorer 8.0.7601.17514

7/10/2011 4:54:14 PM
mbam-log-2011-07-10 (16-54-14).txt

Scan type: Full scan (C:\|)
Objects scanned: 344013
Time elapsed: 32 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
 
Welcome to TechSpot, Gene. I'll help with the redirect.

My Guidelines: please read and follow:
  • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
  • Read my instructions carefully. If you don't understand or have a problem, ask me.
  • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
  • Follow the order of the tasks I give you. Order is crucial in cleaning process.
  • File sharing programs should be uninstalled or disabled during the cleaning process..
  • Observe these:
    [o] Don't use any other cleaning programs or scans while I'm helping you.
    [o] Don't use a Registry cleaner or make any changes in the Registry.
    [o] Don't download and install new programs- except those I give you.
  • Please let me know if there is any change in the system.
If I have not replied for 2 days, you can send me a PM reminder. Include the URL of your thread. Please do not send me a PM to tell me your logs are up.
If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
=====================================
As for this:
ComboFix
MBAM
TDSSKiller
aswMBR
CCLeaner
TFC
DDS
Defogger

RKUnhooker wont run (Exception erreor) and I can't install AVG (Windows Installer error).
Click to expand...

When users panic and gather scans from the internet indiscriminately, they frequently make things work The only program above that could have been run within instructions were Mbam and CCleaner. DDS doesn't 'find' things> it generates 2 logs that show me what's going on in the system. The others should only be run if appropriate and clearly you do not know if you have a rootkit or what/where it is.
================================
We have stopped using TFC because we found a glitch on the system that was removing programs and they could not be recovered. Please uninstall the following
TFC
aswMBR
TDSKiller
Uninstall ComboFix and all Backups of the files it deleted
  • Click START> then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    CF_Uninstall-1.jpg
========================================
Here are our steps for preliminary cleaning: Preliminary Virus and Malware Removal thread HERE.

NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

When you have finished, leave the logs for review in your next reply .
NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.
 
Thanks for your reply... I uninstalled the programs you asked. I'm working on the logs as we speak (or chat). I do notice that after everytime I reboot the pc, all my custom changes (i.e. placing Run on the Start menu, reverts back to how it was before I made the change). None of my personalization changes are kept... FYI
 
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7074

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

7/11/2011 10:53:16 AM
mbam-log-2011-07-11 (10-53-16).txt

Scan type: Quick scan
Objects scanned: 200243
Time elapsed: 2 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
 
When I run DDS
a pop up appeared stating "C:\Users' is not recognized as an internal or external command, operable program or batch file.
The system cannot find the path specified."
 
when Avast was installed
a pop up stating
"MALICIOUS URL BLOCKED
avast! Network Shield blocked a harmful site.
Object: 64.111.211.165
Infection: URL:Mal
Process: C:\Program Files\ Internet Explorer\iexplorer.exe
 
Finally got GMER to run...


GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-12 06:06:02
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


---- Files - GMER 1.0.15 ----

File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26L8AJ2B\bullet[1] 3169 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26L8AJ2B\ErrorPageTemplate[1] 2168 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VAWGL4IA\httpErrorPagesScripts[1] 8601 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNF7SILJ\background_gradient[1] 453 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNF7SILJ\errorPageStrings[1] 1817 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN03EK19\navcancl[1] 2713 bytes
File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN03EK19\info_48[1] 6993 bytes

---- EOF - GMER 1.0.15 ----
 
.
DDS (Ver_2011-06-23.01) - NTFSAMD64 NETWORK
Internet Explorer: 8.0.7601.17514
Run by scadmin at 6:08:42 on 2011-07-12
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4085.2872 [GMT -7:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\scadmin\AppData\Local\temp\Temp1_gmer.zip\gmer.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\REGSVR32.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: {9030d464-4c02-4abf-8ecc-5164760863c6} - Windows Live Sign-in Helper
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: {dbc80044-a445-435b-bc74-9c25c1c588a9} - Java(tm) Plug-In 2 SSV Helper
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
StartupFolder: C:\Users\scadmin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files%20(x86)/Jigsaw%20Puzzle%20Platinum/Images/stg_drm.ocx
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA975} - hxxp://www.3dvista.com/downloads/viewer3dv2.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files%20(x86)/Jigsaw%20Puzzle%20Platinum/Images/armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.137.1
TCP: Interfaces\{5AF1A215-7054-49B8-8BFC-D023297881A1} : DhcpNameServer = 192.168.137.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO-X64: Search Helper - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: {9030D464-4C02-4ABF-8ECC-5164760863C6} - Windows Live Sign-in Helper
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO-X64: Ask Toolbar BHO - No File
BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - Java(tm) Plug-In 2 SSV Helper
BHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
S1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-10-23 92160]
S2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
S2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-7-11 42184]
S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-3 136176]
S2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-6-8 375176]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2011-1-11 15928]
S2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-7-11 366640]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-3-14 632792]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-5-5 206064]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-3 136176]
S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\system32\DRIVERS\lvpopf64.sys --> C:\Windows\system32\DRIVERS\lvpopf64.sys [?]
S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
S3 LVUVC64;Logitech Webcam 250(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]
S3 rcmirror;rcmirror;C:\Windows\system32\DRIVERS\rcmirror.sys --> C:\Windows\system32\DRIVERS\rcmirror.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-07-12 13:00:03 -------- d-sh--w- C:\$RECYCLE.BIN
2011-07-12 08:31:20 -------- d-----w- C:\ComboFix
2011-07-12 08:21:56 -------- d-----w- C:\## aswSnx private storage
2011-07-12 08:21:41 -------- d-----w- C:\Users\scadmin\AppData\Local\SupportSoft
2011-07-12 08:20:03 -------- d-----w- C:\Users\scadmin\AppData\Local\LogMeIn
2011-07-12 07:36:35 208896 ----a-w- C:\Windows\MBR.exe
2011-07-12 07:36:34 98816 ----a-w- C:\Windows\sed.exe
2011-07-12 07:36:34 518144 ----a-w- C:\Windows\SWREG.exe
2011-07-12 07:36:34 256000 ----a-w- C:\Windows\PEV.exe
2011-07-12 07:11:20 -------- d-----w- C:\Users\scadmin\AppData\Roaming\Malwarebytes
2011-07-11 17:50:06 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-11 16:58:14 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-07-11 16:58:12 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-07-11 16:57:28 40112 ----a-w- C:\Windows\avastSS.scr
2011-07-11 16:57:23 -------- d-----w- C:\ProgramData\AVAST Software
2011-07-11 16:57:23 -------- d-----w- C:\Program Files\AVAST Software
2011-07-11 08:09:29 607017 ------r- C:\dds.scr
2011-07-11 05:59:07 -------- d-----w- C:\GeneFix12890G
2011-07-11 03:08:16 -------- d-----w- C:\b34d75abe2bba4ba63fd22c4
2011-07-10 22:13:13 -------- d-----w- C:\GeneFix
2011-07-10 21:58:07 35712 ----a-w- C:\Windows\SysWow64\drivers\BlackBox.sys
2011-07-10 04:01:05 60800 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\LMIproc.dll
2011-07-10 04:01:04 33152 ----a-w- C:\Windows\System32\LMIport.dll
2011-07-10 04:01:03 87456 ----a-w- C:\Windows\System32\LMIRfsClientNP.dll
2011-07-10 04:01:03 72216 ----a-w- C:\Windows\System32\drivers\LMIRfsDriver.sys
2011-07-10 04:00:59 80768 ----a-w- C:\Windows\System32\LMIinit.dll
2011-07-10 04:00:54 -------- d-----w- C:\ProgramData\LogMeIn
2011-07-10 04:00:46 -------- d-----w- C:\Program Files (x86)\LogMeIn
2011-07-10 03:28:02 -------- d-----w- C:\Program Files\WiseFixer
2011-07-10 00:52:05 -------- d-----w- C:\Program Files (x86)\Actual Installer
2011-07-09 20:09:10 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{21376A12-41A2-499D-809C-57ADF3380CA1}\mpengine.dll
2011-07-09 19:16:11 -------- d-----w- C:\ProgramData\MFAData
2011-07-09 19:01:02 -------- d-----w- C:\ProgramData\Malwarebytes
2011-07-09 19:00:58 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-07-09 19:00:33 -------- d-----w- C:\Program Files\CCleaner
2011-07-09 18:47:29 -------- d-----w- C:\Downloads
2011-07-02 16:43:59 -------- d-----w- C:\Windows\System32\SPReview
2011-07-02 16:42:42 -------- d-----w- C:\Windows\System32\EventProviders
2011-07-01 19:07:09 48976 ----a-w- C:\Windows\System32\netfxperf.dll
2011-07-01 19:07:09 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2011-07-01 19:07:02 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2011-07-01 19:05:59 905216 ----a-w- C:\Windows\SysWow64\mmsys.cpl
2011-07-01 19:04:58 323072 ----a-w- C:\Windows\SysWow64\drvstore.dll
2011-07-01 19:04:58 257024 ----a-w- C:\Windows\SysWow64\dpx.dll
2011-07-01 19:04:56 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2011-07-01 19:04:56 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
2011-07-01 19:03:38 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2011-07-01 19:03:38 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll
2011-07-01 19:03:38 1225216 ----a-w- C:\Windows\System32\wbem\wbemcore.dll
2011-07-01 19:03:35 933376 ----a-w- C:\Windows\System32\SmiEngine.dll
2011-07-01 19:03:33 199168 ----a-w- C:\Windows\System32\PkgMgr.exe
2011-07-01 19:03:13 422912 ----a-w- C:\Windows\System32\drvstore.dll
2011-07-01 19:03:13 399872 ----a-w- C:\Windows\System32\dpx.dll
2011-06-16 16:01:08 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-06-16 16:01:07 499200 ----a-w- C:\Windows\System32\drivers\afd.sys
2011-06-16 16:01:07 288640 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2011-06-16 16:01:02 759296 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-16 16:01:02 1110528 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-16 16:01:00 3135488 ----a-w- C:\Windows\System32\win32k.sys
2011-06-16 16:01:00 289280 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-06-16 16:01:00 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2011-06-16 16:01:00 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2011-06-16 15:59:50 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
2011-06-16 15:59:50 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
2011-06-16 15:59:50 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-06-16 15:59:49 467456 ----a-w- C:\Windows\System32\drivers\srv.sys
2011-06-16 15:59:49 410112 ----a-w- C:\Windows\System32\drivers\srv2.sys
2011-06-16 15:59:49 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-06-16 15:59:49 168448 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2011-06-16 15:59:48 861696 ----a-w- C:\Windows\System32\oleaut32.dll
2011-06-16 15:59:48 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-06-16 15:59:44 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-06-16 15:59:44 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
.
==================== Find3M ====================
.
2011-07-02 16:51:43 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-07-02 16:51:43 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-05-28 03:30:09 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-05-28 02:53:58 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-05-25 02:14:10 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe
2011-05-04 05:25:03 2315776 ----a-w- C:\Windows\System32\tquery.dll
2011-05-04 05:22:25 778752 ----a-w- C:\Windows\System32\mssvp.dll
2011-05-04 05:22:25 2223616 ----a-w- C:\Windows\System32\mssrch.dll
2011-05-04 05:22:24 75264 ----a-w- C:\Windows\System32\msscntrs.dll
2011-05-04 05:22:24 491520 ----a-w- C:\Windows\System32\mssph.dll
2011-05-04 05:22:24 288256 ----a-w- C:\Windows\System32\mssphtb.dll
2011-05-04 05:19:28 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
2011-05-04 05:19:28 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
2011-05-04 05:19:28 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
2011-05-04 04:34:43 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll
2011-05-04 04:32:02 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
2011-05-04 04:32:01 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
2011-05-04 04:32:01 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
2011-05-04 04:32:01 1401344 ----a-w- C:\Windows\SysWow64\mssrch.dll
2011-05-04 04:32:00 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
2011-05-04 04:28:31 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2011-05-04 04:28:31 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
2011-05-04 04:28:31 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
2011-04-22 22:15:29 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2011-04-22 22:08:29 1188864 ----a-w- C:\Windows\System32\wininet.dll
2011-04-22 19:10:01 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
.
============= FINISH: 6:16:49.87 ===============
 
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 11/10/2009 8:12:53 PM
System Uptime: 7/12/2011 2:08:44 AM (4 hours ago)
.
Motherboard: Dell Inc. | | 0T287N
Processor: Pentium(R) Dual-Core CPU E5300 @ 2.60GHz | Socket 775 | 2593/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 581 GiB total, 546.905 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer:
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: avast! Network Shield Support
Device ID: ROOT\LEGACY_ASWTDI\0000
Manufacturer:
Name: avast! Network Shield Support
PNP Device ID: ROOT\LEGACY_ASWTDI\0000
Service: aswTdi
.
==== System Restore Points ===================
.
RP533: 7/11/2011 9:51:04 AM - ComboFix created restore point
RP534: 7/11/2011 9:57:16 AM - avast! Free Antivirus Setup
.
==== Installed Programs ======================
.
Actual Installer 3.8
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.1.2
Adobe Reader 9.3
Adobe Shockwave Player 11.5
Ask Toolbar
avast! Free Antivirus
Belarc Advisor 8.1
Boatload of Crosswords
BufferChm
CameraHelperMsi
Championship Five Hundred All-Stars 7.30
Championship Gin All-Stars 7.30
Choice Guard
Compatibility Pack for the 2007 Office system
Consumer In-Home Service Agreement
D1500
Dealio Toolbar v4.0.1
Dell Communications (Support Software)
Dell Getting Started Guide
Dell Support Center (Support Software)
DeviceDiscovery
DJ_SF_03_D1500_Software_Min
Download Updater (AOL LLC)
erLT
Google Earth Plug-in
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
GoToAssist 8.0.0.514
GPBaseService2
Hardwood Solitaire III
Hardwood Spades
HP Update
HPPhotoGadget
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
Infinite Crosswords
Java Auto Updater
Java(TM) 6 Update 20
Junk Mail filter update
Logitech Webcam Software
LogMeIn
LWS Facebook
LWS Gallery
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Twitter
LWS Video Mask Maker
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
Malwarebytes' Anti-Malware version 1.51.0.1200
MarketResearch
Mavis Beacon Teaches Typing 17
Microsoft Corporation
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Suite 2006
Microsoft Digital Image Suite 2006 Editor
Microsoft Digital Image Suite 2006 Library
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Word Viewer 2003
Microsoft Picture It! Photo Premium 2001
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MSVCRT
NetZero For Riverdeep
Picasa 3
PowerDVD DX
Print Artist 2003
Realtek High Definition Audio Driver
Registry Mechanic 10.0
Roxio Burn
Roxio Update Manager
Ruckus Buck's Dangerous Mines
SCRABBLE
Security Update for CAPICOM (KB931906)
Shockwave
SierraAddressBook 3.0
Simply Money 2.5
Skype Toolbars
Skype™ 4.2
SmartWebPrinting
SolutionCenter
Status
Sudoku Quest
Super Jigsaw - Puppies (remove only)
Toolbox
TrayApp
UnloadSupport
Verizon High Speed Internet
Visual C++ 8.0 Runtime Setup Package (x64)
Vz In Home Agent
Web Games Player Plugin
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
WinPatrol 2009
WordUp
Works Suite OS Pack
.
==== Event Viewer Messages From Past Week ========
.
7/9/2011 9:52:01 AM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:15:01 AM, Error: Service Control Manager [7034] - The Windows installer service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:13:16 AM, Error: Service Control Manager [7034] - The SupportSoft Sprocket Service (DellSupportCenter) service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:42 AM, Error: Service Control Manager [7034] - The AVG9IDSAgent service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:36 AM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 2 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SupportSoft Sprocket Service (DellComms) service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SAS Core Service service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The PC Tools Startup and Shutdown Monitor service service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The MSCamSvc service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The Dock Login Service service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 9:11:35 AM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
7/9/2011 4:33:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service stisvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
7/9/2011 12:56:55 PM, Error: Application Popup [1060] - \??\C:\GeneFix7300G\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
7/9/2011 12:53:57 PM, Error: Service Control Manager [7034] - The SoftThinks Agent Service service terminated unexpectedly. It has done this 1 time(s).
7/9/2011 12:08:25 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
7/9/2011 11:33:35 AM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The system cannot find the file specified.
7/9/2011 11:33:35 AM, Error: Service Control Manager [7000] - The AVG Firewall service failed to start due to the following error: The system cannot find the file specified.
7/9/2011 11:33:31 AM, Error: Service Control Manager [7002] - The AVG9IDSAgent service depends on the AVGIDSDriver group and no member of this group started.
7/9/2011 11:33:31 AM, Error: Service Control Manager [7001] - The AVG9IDSDriver service depends on the AVG9IDSFilter service which failed to start because of the following error: The system cannot find the path specified.
7/9/2011 11:33:31 AM, Error: Service Control Manager [7000] - The AVG9IDSFilter service failed to start due to the following error: The system cannot find the path specified.
7/9/2011 11:24:28 AM, Error: Application Popup [1060] - \??\C:\GeneFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
7/9/2011 10:25:55 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx64 AvgMfx64 discache SASDIFSV SASKUTIL spldr Wanarpv6
7/9/2011 1:28:53 PM, Error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
7/8/2011 9:02:01 AM, Error: Service Control Manager [7034] - The Windows installer service terminated unexpectedly. It has done this 2 time(s).
7/8/2011 11:36:05 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AVG WatchDog service to connect.
7/8/2011 11:36:05 AM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/7/2011 9:20:01 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 4 time(s).
7/7/2011 9:19:59 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
7/7/2011 9:19:58 PM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 2 time(s).
7/7/2011 9:19:58 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
7/7/2011 9:15:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgfwfd AvgLdx64 AvgMfx64 AvgTdiA DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx Wanarpv6 WfpLwf
7/7/2011 8:30:39 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 5 time(s).
7/7/2011 8:30:39 PM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 3 time(s).
7/7/2011 8:30:38 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
7/7/2011 10:54:07 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s).
7/12/2011 6:16:20 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
7/12/2011 2:09:55 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
7/12/2011 2:09:54 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
7/12/2011 2:09:54 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/12/2011 2:09:48 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
7/12/2011 2:09:07 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi discache SASDIFSV SASKUTIL spldr Wanarpv6
7/12/2011 2:07:57 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
7/12/2011 12:18:12 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
7/12/2011 12:18:12 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
7/12/2011 1:33:13 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
7/12/2011 1:22:07 AM, Error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified.
7/12/2011 1:22:07 AM, Error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified.
7/12/2011 1:21:49 AM, Error: Microsoft-Windows-WMPNSS-Service [14324] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(WindowsMediaPlayer) encountered error '0x80004002'. If possible, reinstall Windows Media Player.
7/11/2011 9:51:41 AM, Error: Service Control Manager [7034] - The Andrea RT Filters Service service terminated unexpectedly. It has done this 1 time(s).
7/11/2011 9:32:05 AM, Error: Service Control Manager [7034] - The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s).
7/11/2011 9:32:05 AM, Error: Service Control Manager [7034] - The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s).
7/11/2011 8:20:14 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
7/11/2011 1:05:11 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache SASDIFSV SASKUTIL spldr Wanarpv6
7/10/2011 9:25:36 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff800030685ed, 0xfffff88007304ce0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071011-24039-01.
7/10/2011 8:09:24 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 4 Client Profile for Windows 7 x64-based Systems (KB982670).
7/10/2011 4:21:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
7/10/2011 4:14:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service LMIGuardianSvc with arguments "" in order to run the server: {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
7/10/2011 3:08:26 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:06:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
7/10/2011 3:06:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
7/10/2011 3:06:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx Wanarpv6 WfpLwf
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
.
==== End Of File ===========================
 
Okay, let's start with some questions and comments:

1. Are you a developer? What are you using this for> Actual Installer 3.8? Is it still in the Trial Period or have you paid for it. If in Trial, recommend uninstall.
2, It appears you have received remote at some period. Processes for LogMeIn are still running. It would be best to stop and remove if not using now.
07-10 04:00:46 -------- d-----w- C:\Program Files (x86)\LogMeIn
3. There are numerous entries for Ask Toolbar We can remove them. But I wanted to caution you that this is often pre-checked on some download screens. It's best to check all download screens and uncheck any pre-checks before you download.
====================================================
There is still a directory for Combofix on the C Drive. IF you haven't uninstalled Combofix, please do so as follows. IF you have uninstalled Combofix, use Windows Explorer to navigate to the C Drive > right click> Delete C:\ComboFix
Please note: If you have Combofix on the desktop already, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
  • Click START> then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
--------------------------------------
I also see entries for AVG9 on the system. Combofix won't run with AVG so you will need to temporarily remove it as follows:
Download AppRemover and save to the desktop
  1. Double click the setup on the desktop> click Next
  2. Select “Remove Security Application”
  3. Let scan finish to determine security apps
  4. A screen like below will appear:
    image_preview
  5. Click on Next after choice has been made
  6. Check the AVG program you want to uninstall
  7. After uninstall shows complete, follow online prompts to Exit the program.

Since you have Avast on the system, you will not need a temporary replacement for AVG.
=============================
Download Combofix from HERE or HEREhttp://www.forospyware.com/sUBs/ComboFix.exe and save to the desktop
  • Double click combofix.exe & follow the prompts.
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
    whatnext.png
  • .Click on Yes, to continue scanning for malware
  • .If Combofix asks you to update the program, allow
  • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • .Close any open browsers.
  • .Double click combofix.exe
    cf-icon.jpg
    & follow the prompts to run.
  • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
Re-enable your Antivirus software.

Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
=========================================
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESETOnlineScan
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    [o] Double click on the
    esetSmartInstallDesktopIcon.png
    on your desktop.
  • Check 'Yes I accept terms of use.'
  • Click Start button
  • Accept any security warnings from your browser.
    esetonlinescannersettings_thumb.jpg
  • Uncheck 'Remove found threats'
  • Check 'Scan archives/
  • Leave remaining settings as is.
  • Press the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
  • When the scan completes, press List of found threats
  • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
  • Push the Back button
  • Push Finish

NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
==================================
Note: Some of what I have to do is to remove left-over processes from programs you gathered to 'fix' the system.
 
From the time that I last posted till the time that I recevied your post (~12 hrs) the computer seems to be reinfected as if I had not run any scans at all. I have a fake security alert, I can NOT run any executables (a little popup says I am infected by a Blaster virus), no task manager, all my desktop and document files are hidden. I'm going to reboot in safe mode and run a combofix. I think it is best to keep this computer off the internet till we know it is cured. I'll post the ComboFix log next.
 
It's wierd... ComboFix isn't detecting anything.

ComboFix 11-07-07.03 - scadmin 07/12/2011 19:13:44.10.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4085.2800 [GMT -7:00]
Running from: c:\users\scadmin\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 )))))))))))))))))))))))))))))))
.
.
2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\MERV\AppData\Local\temp
2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\Merv & Fran\AppData\Local\temp
2011-07-12 22:44 . 2011-07-12 22:44 920576 ----a-w- c:\programdata\defender.exe
2011-07-12 07:02 . 2011-07-12 08:21 -------- d-----w- c:\users\scadmin
2011-07-11 17:50 . 2011-05-29 16:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-11 16:58 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-07-11 16:58 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-11 16:58 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-11 16:58 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-11 16:58 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-11 16:58 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-11 16:58 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-11 16:57 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-07-11 16:57 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-11 16:57 . 2011-07-11 16:57 -------- d-----w- c:\programdata\AVAST Software
2011-07-11 16:57 . 2011-07-11 16:57 -------- d-----w- c:\program files\AVAST Software
2011-07-11 08:09 . 2011-07-10 21:56 607017 ------r- C:\dds.scr
2011-07-11 03:08 . 2011-07-11 03:09 -------- d-----w- C:\b34d75abe2bba4ba63fd22c4
2011-07-10 22:13 . 2011-07-10 23:08 -------- d-----w- C:\GeneFix
2011-07-10 21:58 . 2011-07-11 03:33 35712 ----a-w- c:\windows\SysWow64\drivers\BlackBox.sys
2011-07-10 04:18 . 2011-07-11 04:29 -------- d-----w- c:\users\LogMeInRemoteUser
2011-07-10 04:01 . 2011-07-10 04:01 -------- d-----w- c:\users\Merv & Fran\AppData\Local\LogMeIn
2011-07-10 04:01 . 2011-06-08 20:06 60800 ----a-w- c:\windows\system32\Spool\prtprocs\x64\LMIproc.dll
2011-07-10 04:01 . 2011-06-08 20:06 33152 ----a-w- c:\windows\system32\LMIport.dll
2011-07-10 04:01 . 2011-06-08 20:06 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2011-07-10 04:01 . 2011-01-12 02:04 72216 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2011-07-10 04:00 . 2011-06-08 20:06 80768 ----a-w- c:\windows\system32\LMIinit.dll
2011-07-10 04:00 . 2011-07-13 07:00 -------- d-----w- c:\programdata\LogMeIn
2011-07-10 04:00 . 2011-07-10 04:00 -------- d-----w- c:\program files (x86)\LogMeIn
2011-07-10 03:28 . 2011-07-10 03:28 -------- d-----w- c:\program files\WiseFixer
2011-07-10 00:52 . 2011-07-10 00:52 -------- d-----w- c:\program files (x86)\Actual Installer
2011-07-09 20:09 . 2011-06-20 15:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{21376A12-41A2-499D-809C-57ADF3380CA1}\mpengine.dll
2011-07-09 19:16 . 2011-07-09 19:16 -------- d-----w- c:\programdata\MFAData
2011-07-09 19:01 . 2011-07-09 19:01 -------- d-----w- c:\users\Merv & Fran\AppData\Roaming\Malwarebytes
2011-07-09 19:01 . 2011-07-09 19:01 -------- d-----w- c:\programdata\Malwarebytes
2011-07-09 19:00 . 2011-07-11 17:50 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-09 19:00 . 2011-07-09 19:00 -------- d-----w- c:\program files\CCleaner
2011-07-09 18:47 . 2011-07-12 21:55 -------- d-----w- C:\Downloads
2011-07-02 16:43 . 2011-07-02 16:43 -------- d-----w- c:\windows\system32\SPReview
2011-07-02 16:42 . 2011-07-02 16:42 -------- d-----w- c:\windows\system32\EventProviders
2011-07-01 19:07 . 2010-11-05 01:57 48976 ----a-w- c:\windows\system32\netfxperf.dll
2011-07-01 19:07 . 2010-11-05 01:57 1942856 ----a-w- c:\windows\system32\dfshim.dll
2011-07-01 19:07 . 2010-11-05 01:58 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2011-07-01 19:05 . 2010-11-20 13:34 363392 ----a-w- c:\windows\system32\drivers\volmgrx.sys
2011-07-01 19:04 . 2010-11-20 12:18 323072 ----a-w- c:\windows\SysWow64\drvstore.dll
2011-07-01 19:04 . 2010-11-20 12:18 257024 ----a-w- c:\windows\SysWow64\dpx.dll
2011-07-01 19:04 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
2011-07-01 19:04 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
2011-07-01 19:03 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2011-07-01 19:03 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
2011-07-01 19:03 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2011-07-01 19:03 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
2011-07-01 19:03 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
2011-07-01 19:03 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
2011-07-01 19:03 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
2011-06-16 16:01 . 2011-04-25 05:33 1923968 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-16 16:01 . 2011-04-25 02:34 499200 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-16 16:01 . 2010-11-20 13:33 288640 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2011-06-16 16:01 . 2011-04-29 05:55 1110528 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-16 16:01 . 2011-04-29 04:57 759296 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-16 16:01 . 2011-05-28 03:06 3135488 ----a-w- c:\windows\system32\win32k.sys
2011-06-16 16:01 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-16 16:01 . 2011-04-27 02:39 289280 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 16:01 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 15:59 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2011-06-16 15:59 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2011-06-16 15:59 . 2010-11-20 13:26 321024 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-06-16 15:59 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-16 15:59 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-16 15:59 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-16 15:59 . 2010-11-20 12:18 219136 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
2011-06-16 15:59 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-16 15:59 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-06-16 15:59 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-16 15:59 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-02 16:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-02 16:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-05-25 02:14 . 2009-11-11 19:04 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-04-22 22:15 . 2011-05-24 23:40 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-12_09.10.39 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-07-12 08:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-07-13 15:17 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-12 08:22 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-13 15:17 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-12 08:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-13 15:17 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-23 05:22 . 2011-07-12 23:09 67764 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-07-13 15:17 55338 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-11-11 01:58 . 2011-07-13 15:15 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-11-11 01:58 . 2011-07-12 08:19 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-07-11 00:31 . 2011-07-12 08:19 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-07-11 00:31 . 2011-07-13 15:15 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-12 08:19 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-13 15:15 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-11 19:02 . 2011-07-12 09:09 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-11 19:02 . 2011-07-13 15:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-11-11 19:02 . 2011-07-12 09:09 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-11-11 19:02 . 2011-07-13 15:15 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-11 19:02 . 2011-07-12 09:09 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-11 19:02 . 2011-07-13 15:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-11 06:11 . 2011-07-12 06:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-11 06:11 . 2011-07-13 15:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-11 06:11 . 2011-07-13 15:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-11 06:11 . 2011-07-12 06:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-07-12 09:09 . 2011-07-12 09:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-13 02:19 . 2011-07-13 15:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-13 02:19 . 2011-07-13 15:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-07-12 09:09 . 2011-07-12 09:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 05:01 . 2011-07-13 02:18 392972 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-07-12 08:22 392972 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-04-16 15:44 . 2011-04-16 15:44 2770944 c:\windows\Installer\2ca31.msi
+ 2011-04-16 07:14 . 2011-04-16 07:14 3186176 c:\windows\Installer\2b81f1.msi
+ 2011-04-16 07:14 . 2011-04-16 07:14 3186176 c:\windows\Installer\2928e.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-29 06:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 136176]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
R3 BlackBox;BlackBox SR2; [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech Webcam 250(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 rcmirror;rcmirror;c:\windows\system32\DRIVERS\rcmirror.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-06-08 375176]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2011-01-12 15928]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-05-05 206064]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 21:51]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 21:51]
.
2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-767072614-1521476138-1784173723-1000Core.job
- c:\users\Merv & Fran\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-15 01:14]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-767072614-1521476138-1784173723-1000UA.job
- c:\users\Merv & Fran\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-15 01:14]
.
2011-07-13 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-03-14 00:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-01-12 57928]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\system32\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.137.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA975} - hxxp://www.3dvista.com/downloads/viewer3dv2.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Completion time: 2011-07-13 08:35:29 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-13 15:35
ComboFix2.txt 2011-07-12 18:45
ComboFix3.txt 2011-07-12 09:28
ComboFix4.txt 2011-07-11 09:26
.
Pre-Run: 588,377,141,248 bytes free
Post-Run: 587,202,760,704 bytes free
.
- - End Of File - - C13D9720D6FFC7209D438771DDB05F93
 
1. Are you a developer? What are you using this for> Actual Installer 3.8? Is it still in the Trial Period or have you paid for it. If in Trial, recommend uninstall.
2, It appears you have received remote at some period. Processes for LogMeIn are still running. It would be best to stop and remove if not using now.
07-10 04:00:46 -------- d-----w- C:\Program Files (x86)\LogMeIn
3. There are numerous entries for Ask Toolbar We can remove them. But I wanted to caution you that this is often pre-checked on some download screens. It's best to check all download screens and uncheck any pre-checks before you download.
Click to expand...

1) I am not a developer... Actual Installer is uninstalled.
2) LogMeIn is uninstalled.
3) I tried to uninstall Ask ToolBar, but it is prompting me that it can not find the uninstall files. I tried reinstalling Ask, but it says it wont because there is already and existing installation.
 
I just plugged in the internet long enough to download and install ESET. I've unplugged the network cable and I'm running the scan now.
 
ESET log...

C:\ProgramData\defender.exe a variant of Win32/Kryptik.QIA trojan
C:\Users\All Users\defender.exe a variant of Win32/Kryptik.QIA trojan
 
Also... AppFinder did NOT detect AVG. Before contacting you, I did run a AVG remover tool downloaded directly from AVG just so I could run ComboFix. This is probably why AppFinder isn't detecting anything. What shall I do next?
 
It's wierd... ComboFix isn't detecting anything.
Click to expand...

Let's talk about this. According to Combofix, this is the third time you've run it. You were instructed to uninstall Combofix and download it from the link given.

Combofix also show me thast you did not disable the security as directed:
AV: avast! Antivirus *Enabled/Updated*
SP: avast! Antivirus *Enabled/Updated*
SP: Windows Defender *Enabled/Updated*
Click to expand...

Combofix also ran in the Reduced Functionality Mode. This can be:
1. Because you didn't disable the security program.
2. Because it's an old version.
3. Because the activation failed.
4. Because the OS isn't legitimate:
You've had this system for 9 months and there are no update or hotfixes.
 
Thank you for your time, however, my client became impatient and instructed me to backup their data and reload the OS. Obviously, everything is working smoothly.
 
For 22 posts, you presented this as your system, Gene. Now, when I ask a question you can't or won't answer, the system now belongs to "my client" and that client is impatient!

Possible are you part of this? Southern California Computer Guys

This thread is closed
 
Status
Not open for further replies.

Similar threads

N
Apple's first mixed reality headset will be expensive, but the company has high hopes...
Replies
22
Views
1K
Puiu
Puiu
Matthew DeCarlo
Weekend tech reading: DRAM prices up 111% from 2016, how to live without Google, 99 PC...
Replies
1
Views
1K
Kibaruk
Kibaruk
DjKraid
Steam: How to spot scams and how to avoid them
Replies
0
Views
18K
DjKraid
DjKraid

Latest posts

Back